Cisco Expressway Series Directory Traversal Vulnerability

Vulnerability

The vulnerability (CVE-2019-1854) exists in the management web interface of Cisco Expressway Series. It is caused by insufficient input validation on the web interface, enabling an authenticated, remote attacker to perform a directory traversal attack. Affected products include all Cisco Expressway Series releases. Specific software versions are not enumerated in the public advisory [1].

Exploitation

To exploit the vulnerability, an attacker must first have valid credentials to authenticate to the affected Cisco Expressway Series. The attacker then sends a crafted HTTP request to the web interface, exploiting the insufficient input validation to traverse directories. No further privileges or user interaction are required beyond authentication [1].

Impact

Successful exploitation allows the attacker to bypass security restrictions on the Expressway device and access the web interface of a Cisco Unified Communications Manager associated with the affected device. However, valid credentials are still required to access the Unified Communications Manager interface. The impact is limited to unauthorized access to the management interface of another system, potentially leading to further compromise [1].

Mitigation

Cisco has released fixed software versions. Customers should consult Cisco bug ID(s) referenced in the advisory for specific fixed releases [1]. There are no workarounds available. The vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog.